OS
Product
Owncloud Server
On CISA KEVExploited in the wild
108
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 8Low 1
Watch
Add Owncloud Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-5056 | – | Jun 4 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) readyCallback… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +1 more |
| CVE-2014-2585 | – | Mar 24 | ownCloud before 5.0.15 and 6.x before 6.0.2, when the file_external app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the… Affected: through 5.0.14; 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; +12 more |
| CVE-2014-2057 | – | Mar 24 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +34 more |
| CVE-2013-7344 | – | Mar 24 | Unspecified vulnerability in core/settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +15 more |
| CVE-2013-0303 | – | Mar 24 | Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +11 more |
| CVE-2013-0201 | – | Mar 18 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +5 more |
| CVE-2013-0301 | – | Mar 14 | Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +9 more |
| CVE-2013-0300 | – | Mar 14 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +1 more |
| CVE-2013-0299 | – | Mar 14 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +16 more |
| CVE-2014-2049 | – | Mar 14 | The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors Affected: 6.0.0; 6.0.1; 3.0.0; 3.0.1; 3.0.2; 3.0.3; +34 more |
| CVE-2014-2047 | – | Mar 14 | Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions… Affected: 6.0.0 |
| CVE-2013-2150 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML… Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5; +33 more |
| CVE-2013-2149 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via… Affected: 5.0.0 before 5.0.7 |
| CVE-2013-2089 | – | Mar 14 | Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a… Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4 |
| CVE-2013-2086 | – | Mar 14 | The configuration loader in ownCloud 5.0.x before 5.0.6 allows remote attackers to obtain CSRF tokens and other sensitive information by reading an unspecified JavaScript file Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5 |
| CVE-2013-2048 | – | Mar 14 | ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4 |
| CVE-2013-2047 | – | Mar 14 | The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate… Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4 |
| CVE-2013-2044 | – | Mar 14 | Open redirect vulnerability in the Login Page (index.php) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4 |
| CVE-2013-2043 | – | Mar 14 | apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +10 more |
| CVE-2013-2042 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +24 more |
| CVE-2013-2041 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tag… Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5 |
| CVE-2013-2040 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +24 more |
| CVE-2013-2039 | – | Mar 14 | Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +24 more |
| CVE-2013-1963 | – | Mar 14 | The contacts application in ownCloud before 4.5.10 and 5.x before 5.0.5 does not properly check the ownership of contacts, which allows remote authenticated users to download… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +8 more |
| CVE-2013-1939 | – | Mar 14 | The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators… Affected: 4.0.0 before 4.0.14; 4.5.0 before 4.5.9; 5.0.0 before 5.0.4 |
| CVE-2013-1851 | – | Mar 14 | Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +18 more |
| CVE-2013-1850 | – | Mar 14 | Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +18 more |
| CVE-2013-1822 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +2 more |
| CVE-2013-0307 | – | Mar 14 | Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +16 more |
| CVE-2013-0298 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +1 more |
| CVE-2013-0297 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +16 more |
| CVE-2013-2046 | – | Mar 9 | SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x before 4.5.11 and 5.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL commands… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +11 more |
| CVE-2013-2045 | – | Mar 9 | SQL injection vulnerability in lib/db.php in ownCloud Server 5.0.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5 |
| CVE-2013-1967 | – | Feb 5 | Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +9 more |
| CVE-2013-6403 | – | Dec 24 | The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5; +6 more |
| CVE-2013-1942 | – | Aug 15 | Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +32 more |
| CVE-2012-5666 | – | Jan 3 | Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote attackers to inject arbitrary web script… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +9 more |
| CVE-2012-5665 | – | Jan 3 | ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +9 more |
| CVE-2012-5610 | – | Dec 18 | Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +6 more |
| CVE-2012-5609 | – | Dec 18 | Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +9 more |
| CVE-2012-5608 | – | Dec 18 | Cross-site scripting (XSS) vulnerability in apps/user_webdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via… Affected: 4.5.0; 4.5.1 |
| CVE-2012-5607 | – | Dec 18 | The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +7 more |
| CVE-2012-5606 | – | Dec 18 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +7 more |
| CVE-2012-4753 | – | Sep 5 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +2 more |
| CVE-2012-4752 | – | Sep 5 | appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +3 more |
| CVE-2012-4397 | – | Sep 5 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3 |
| CVE-2012-4396 | – | Sep 5 | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0 |
| CVE-2012-4395 | – | Sep 5 | Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter Affected: 3.0.0; 3.0.1; 3.0.2; 4.0.0; 4.0.1 |
| CVE-2012-4394 | – | Sep 5 | Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +2 more |
| CVE-2012-4393 | – | Sep 5 | Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 4.0.0; 4.0.1; +3 more |